{"answers":{"affected":"1 open source package ship an affected version, including get-package-lint.","exploited":"There is no known exploitation of MAL-2026-4572 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4572 is a malicious package in get-package-lint, published on 22 May 2026."},"fix_prompt":"MAL-2026-4572 is a malicious package: get-package-lint (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4572/ (Markdown: https://insights.sbomify.com/MAL-2026-4572/index.md)","id":"MAL-2026-4572","markdown":"https://insights.sbomify.com/MAL-2026-4572/index.md","name":"MAL-2026-4572","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package name typosquats the popular `get-package-type` and reuses its README/exports verbatim, but adds `\"postinstall\": \"node utils.cjs\"` in package.json. utils.cjs is a 263 KB obfuscator.io-protected blob (string-array rotation with anti-debug `debugger` loops, RegExp toString fingerprint, and `Function('return this')` sandbox checks) that on `npm install`: (1) decodes a hardcoded base64+XOR-obfuscated URL and bearer token (HF_TOKEN), (2) HTTPS-GETs a platform-specific binary (linux-x64 / darwin-arm64 / win32-x64 selected via DOWNLOAD_MAP), (3) writes it under the user's local data directory, `chmod 0755` on POSIX, and spawns it detached, (4) installs OS-level persistence: on Windows via `reg add HKCU\\...\\CurrentVersion\\Run`, on macOS via a LaunchAgent plist under `~/Library/LaunchAgents`, on Linux via a systemd user unit at `~/.config/systemd/user/\u003cunit\u003e.service` followed by `systemctl --user daemon-reload \u0026\u0026 enable \u0026\u0026 start`. The script also self-detaches by re-spawning itself with a `child` argv via `{detached:true, stdio:'ignore'}` and calling `process.exit(0)` so npm sees success while the dropper continues asynchronously. The fetched bytes are opaque, unverified (no hash/signature), and the source domain is not the package's publisher. This is an unambiguous binary-runner-dropper plus backdoor persistence triggered on every install.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in get-package-lint (npm)","id":"MAL-2026-4572","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"get-package-lint","purl":"pkg:npm/get-package-lint","source":"MAL-2026-4572"}],"products":null,"published":"2026-05-22","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4572/"}